Skip to content

Commit 44021bb

Browse files
committed
Merged PR 10664: Update dev branch from public GitHub dev
#### AI description
1 parent a22ab8e commit 44021bb

File tree

26 files changed

+307
-111
lines changed

26 files changed

+307
-111
lines changed

.github/ISSUE_TEMPLATE/bug_report.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
name: Bug report
33
about: Please do NOT file bugs without filling in this form.
44
title: '[Bug] '
5-
labels: ''
5+
labels: ["untriaged", "needs attention"]
66
assignees: ''
77

88
---
Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
---
2+
name: 🤔 Design proposal
3+
about: Collaborate on a design for a feature/fix or other change
4+
labels: design-proposal
5+
---
6+
7+
<!--
8+
This template is useful to build consensus about whether work should be done, and if so, the high-level shape of how it should be approached. Use this before fixating on a particular implementation.
9+
-->
10+
11+
## Summary
12+
13+
1-2 sentences. Say what this is about.
14+
15+
## Motivation and goals
16+
17+
1-2 paragraphs, or a bullet-pointed list. What existing pain points does this solve? What evidence shows it's valuable to solve this?
18+
19+
## In scope
20+
21+
A list of major scenarios, perhaps in priority order.
22+
23+
## Out of scope
24+
25+
Scenarios you explicitly want to exclude.
26+
27+
## Risks / unknowns
28+
29+
How might developers misinterpret/misuse this? How might implementing it restrict us from other enhancements in the future? Also list any perf/security/correctness concerns.
30+
31+
## Examples
32+
33+
Give brief examples of possible developer experiences (e.g., code they would write).
34+
35+
Don't be deeply concerned with how it would be implemented yet. Your examples could even be from other technology stacks.
36+
37+
<!--
38+
# Detailed design
39+
40+
It's often best not to fill this out until you get basic consensus about the above. When you do, consider adding an implementation proposal with the following headings:
41+
42+
Detailed design
43+
Drawbacks
44+
Considered alternatives
45+
Open questions
46+
References
47+
48+
If there's one clear design you have consensus on, you could do that directly in a PR.
49+
-->

CHANGELOG.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
See the [releases](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases) for details on bug fixes and added features.
22

3+
7.0.3
4+
======
5+
### Bug Fixes:
6+
- Fix errors like the following reported by multiple customers at dotnet/aspnetcore#51005 when they tried to upgrade their app using `AddMicrosoftIdentityWebApp` to .NET 8. See [PR](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/2361) for details.
7+
- Fix compatibility issue with 6x when claims are a bool. See issue [#2354](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/2354) for details.
8+
39
7.0.2
410
======
511
### Bug Fixes:

Contributing.md

Lines changed: 60 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,21 +18,57 @@ Please file issues you see in the [issue tracker](https://github.com/AzureAD/azu
1818

1919
## Instructions for Contributing Code
2020

21-
### Contributing bug fixes
21+
### Contributor License agreement
2222

23-
We accept bug fixes. A bug must have an issue tracking it in the issue tracker. Please link the issue and PR.
23+
Please visit [https://cla.microsoft.com/](https://cla.microsoft.com/) and sign the Contributor License
24+
Agreement. You only need to do that once. We can not look at your code until you've submitted this request.
2425

25-
### Contributing features
26+
### Finding an issue to work on
2627

27-
Features (things that add new or improved functionality) may be accepted, but will need to first be approved (tagged with "Enhancement") in the issue.
28+
Over the years we've seen many PRs targeting areas of the code which are not urgent or critical for us to address, or areas which we didn't plan to expand further at the time. In all these cases we had to say no to those PRs and close them. That, obviously, is not a great outcome for us. And it's especially bad for the contributor, as they've spent a lot of effort preparing the change. To resolve this problem, we've decided to separate a bucket of issues, which would be great candidates for community members to contribute to. We mark these issues with the help wanted label. You can find all these issues [here](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues?q=is%3Aopen+is%3Aissue+label%3A%22help+wanted%22+label%3A%22good+first+issue%22+).
2829

29-
## Legal
30+
With that said, we have additionally marked issues that are good candidates for first-time contributors. Those do not require too much familiarity with the authN/authZ and are more novice-friendly. Those are marked with the good first issue label.
3031

31-
You will need to complete a Contributor License Agreement (CLA). Briefly, this agreement testifies that you are granting us permission to use the submitted change according to the terms of the project's license, and that the work being submitted is under appropriate copyright.
32+
If you would like to make a contribution to an area not captured [here](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues?q=is%3Aopen+is%3Aissue+label%3A%22help+wanted%22+label%3A%22good+first+issue%22+), first open an issue with a description of the change you would like to make and the problem it solves so it can be discussed before a pull request is submitted.
3233

33-
Please submit a Contributor License Agreement (CLA) before submitting a pull request. You may visit https://cla.microsoft.com to sign digitally. Once we have received the signed CLA, we'll review the request.
34+
If you are working on an involved feature, please file a design proposal, more instructions can be found below, under [Before writing code](#before-writing-code).
3435

35-
## Housekeeping
36+
### Before writing code
37+
38+
We've seen PRs, where customers would solve an issue in a way which either wouldn't fit into the E2E design because of how it's implemented, or it would change the E2E in a way, which is not something we'd like to do. To avoid these situations and potentially save you a lot of time, we encourage customers to discuss the preferred design with the team first. To do so, file a new design proposal issue, link to the issue you'd like to address, and provide detailed information about how you'd like to solve a specific problem.
39+
40+
To file a design proposal, look for the relevant issue in the `New issue` page or simply click [proposal for Identity Model](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/new?assignees=&labels=design-proposal&projects=&template=design_proposal.md).
41+
42+
### Identifying scale
43+
44+
If you would like to contribute to one of our repositories, first identify the scale of what you would like to contribute. If it is small (grammar/spelling or a bug fix) feel free to start working on a fix. If you are submitting a feature or substantial code contribution, please discuss it with the team and ensure it follows the product roadmap. You might also read these two blogs posts on contributing code: [Open Source Contribution Etiquette by Miguel de Icaza](http://tirania.org/blog/archive/2010/Dec-31.html) and [Don't "Push" Your Pull Requests by Ilya Grigorik](https://www.igvita.com/2011/12/19/dont-push-your-pull-requests/). All code submissions will be rigorously reviewed and tested further by the team, and only those that meet an extremely high bar for both quality and design/roadmap appropriateness will be merged into the source.
45+
46+
### Before submitting the pull request
47+
48+
Before submitting a pull request, make sure that it checks the following requirements:
49+
50+
- You find an existing issue with the "help-wanted" label or discuss with the team to agree on adding a new issue with that label.
51+
- You post a high-level description of how it will be implemented and receive a positive acknowledgement from the team before getting too committed to the approach or investing too much effort in implementing it.
52+
- You add test coverage following existing patterns within the codebase
53+
- Your code matches the existing syntax conventions within the codebase
54+
- Your PR is small, focused, and avoids making unrelated changes
55+
56+
If your pull request contains any of the below, it's less likely to be merged.
57+
58+
- Changes that break backward compatibility
59+
- Changes that are only wanted by one person/company. Changes need to benefit a large enough proportion of developers using our auth libraries.
60+
- Changes that add entirely new feature areas without prior agreement
61+
- Changes that are mostly about refactoring existing code or code style
62+
63+
Very large PRs that would take hours to review (remember, we're trying to help lots of people at once). For larger work areas, please discuss with us to find ways of breaking it down into smaller, incremental pieces that can go into separate PRs.
64+
65+
### During pull request review
66+
67+
A core contributor will review your pull request and provide feedback. To ensure that there is not a large backlog of inactive PRs, the pull request will be marked as stale after two weeks of no activity. After another four days, it will be closed.
68+
69+
### Submitting a pull request
70+
71+
If you're not sure how to create a pull request, read this article: https://help.github.com/articles/using-pull-requests. Make sure the repository can build and all tests pass. Familiarize yourself with the project workflow and our coding conventions. The coding, style, and general engineering guidelines are published on the Engineering guidelines page.
3672

3773
Your pull request should:
3874

@@ -44,6 +80,22 @@ Your pull request should:
4480
* Include new tests for new features
4581
* To avoid line ending issues, set `autocrlf = input` and `whitespace = cr-at-eol` in your git configuration
4682

83+
### Tests
84+
85+
- Tests need to be provided for every bug/feature that is completed.
86+
- Unit tests cover all new aspects of the code.
87+
- Before and after performance and stress tests results are evaluated (no regressions allowed).
88+
- Performance and stress tests are extended as relevant.
89+
90+
### Feedback
91+
92+
Your pull request will now go through extensive checks by the subject matter experts on our team. Please be patient; we have hundreds of pull requests across all of our repositories. Update your pull request according to feedback until it is approved by one of the team members.
93+
94+
### Merging pull requests
95+
96+
When your pull request has had all feedback addressed, it has been signed off by one or more reviewers with commit access, and all checks are green, we will commit it.
97+
We commit pull requests as a single Squash commit unless there are special circumstances. This creates a simpler history than a Merge or Rebase commit. "Special circumstances" are rare, and typically mean that there are a series of cleanly separated changes that will be too hard to understand if squashed together, or for some reason we want to preserve the ability to dissect them.
98+
4799
## Building and running tests
48100

49101
To build and run tests, use 'build'

README.md

Lines changed: 15 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Azure Active Directory IdentityModel Extensions for .NET
1+
# IdentityModel Extensions for .NET
22

33
[![Nuget](https://img.shields.io/nuget/v/Microsoft.IdentityModel.JsonWebTokens?label=Latest%20release)](https://www.nuget.org/packages/Microsoft.IdentityModel.JsonWebTokens/)
44

@@ -8,62 +8,36 @@ IdentityModel Extensions for .NET provide assemblies that are interesting for we
88

99
You can find the release notes for each version [here](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases). Older versions can be found [here](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/wiki/Release-Notes).
1010

11-
## Note about 6.28.0
12-
We delisted 6.28.0 as we found an edge case where a null reference could occur.
13-
Please use 6.28.1.
11+
## IdentityModel 7x
1412

15-
## Note about 6.x
16-
17-
If you noticed, we bumped the release from 5.x to 6.x\
18-
We were maintaining two releases from two different branches.\
19-
dev - 6.x\
20-
dev5x - 5.x
21-
22-
Internally at Microsoft we were quickly required to remove all 3rd party libraries as IdentityModel is all about securing resources.\
23-
Since there were some breaking changes, given the time-line we had to maintain two releases.
24-
25-
Both of these branches were public and moved forward mostly in lock-step.\
26-
Once we finished our SignedHttpRequest functionality in the 6.x branch, we realized the delta between 5.x and 6.x was too large to maintain in both branches.\
27-
We decided now was the time to switch to a single release branch.\
28-
Since internally the versioning was at 6.4.2, we needed to release at 6.5.0.
29-
30-
## There are some small breaking changes
31-
32-
We built and tested ASP.NET core with 6.5.0 without issues.\
33-
We also upgraded in place existing applications to 6.5.0 without issues.\
34-
This of course does not mean you will not hit issues, but we took it seriously.
13+
We are excited to announce the release of [IdentityModel 7x](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/wiki/IdentityModel-7x), a major update to our popular .NET auth validation library. This new version introduces several improvements related to serialization and consistency in the API, which will provide a better user experience for developers, as well as full AOT compatibility on .NET, and huge perf improvements compared to 6x.
3514

36-
Any questions or compatibility problems please open issues [here](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc).
37-
38-
## Thank you for using our product
39-
40-
The IdentityModel Team.
41-
42-
## Usage
43-
44-
IdentityModel Extensions for .NET 5 has now been released. If you are using IdentityModel Extensions with ASP.NET, the following combinations are supported:
15+
## Note about 6.x
4516

46-
* **IdentityModel Extensions for .NET 5.x**, **ASP.NET Core 1.x**, **ASP.NET Core 2.x**, **Katana 4.x**
47-
* **IdentityModel Extensions for .NET 4.x**, **ASP.NET 4**, **Katana 3.x**
48-
All other combinations aren't supported.
17+
We bumped the release from 6.x to 7.x.
18+
We are maintaining two releases from two different branches.
19+
dev - 7.x
20+
dev6x - 6.x
4921

50-
For more details see [Migration notes here](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/wiki/Migrating-from-Katana-(OWIN)-3.x-to-4.x)
22+
dev6x will be maintained until March 2024, at which point, you will need to move to 7x to continue to get the latest and greatest improvements and security updates.
5123

5224
## Samples and Documentation
5325

5426
The scenarios supported by IdentityModel extensions for .NET are described in [Scenarios](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/wiki/scenarios). The libraries are in particular used part of ASP.NET security to validate tokens in ASP.NET Web Apps and Web APIs. To learn more about token validation, and find samples, see:
5527

56-
- [Azure Active Directory with ASP.NET Core](https://docs.microsoft.com/en-us/aspnet/core/security/authentication/azure-active-directory/?view=aspnetcore-2.1)
57-
- [Developing ASP.NET Apps with Azure Active Directory](https://docs.microsoft.com/en-us/aspnet/identity/overview/getting-started/developing-aspnet-apps-with-windows-azure-active-directory)
28+
- [Microsoft Entra ID with ASP.NET Core](https://docs.microsoft.com/en-us/aspnet/core/security/authentication/azure-active-directory/?view=aspnetcore-2.1)
29+
- [Developing ASP.NET Apps with Microsoft Entra ID](https://docs.microsoft.com/en-us/aspnet/identity/overview/getting-started/developing-aspnet-apps-with-windows-azure-active-directory)
5830
- [Validating tokens](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/wiki/ValidatingTokens)
5931
- more generally, the library's [Wiki](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/wiki)
6032
- the [reference documentation](https://learn.microsoft.com/dotnet/api/microsoft.identitymodel.jsonwebtokens.jsonwebtokenhandler?view=msal-web-dotnet-latest)
6133

6234
## Community Help and Support
6335

64-
We leverage [Stack Overflow](http://stackoverflow.com/) to work with the community on supporting Azure Active Directory and its SDKs, including this one! We highly recommend you ask your questions on Stack Overflow (we're all on there!) Also browse existing issues to see if someone has had your question before.
36+
We leverage [Stack Overflow](http://stackoverflow.com/) to work with the community on supporting Microsoft Entra and its SDKs, including this one! We highly recommend you ask your questions on Stack Overflow (we're all on there!) Also browse existing issues to see if someone has had your question before.
37+
38+
We recommend you use the "identityModel" tag so we can see it! Here is the latest Q&A on Stack Overflow for IdentityModel: [https://stackoverflow.com/questions/tagged/identityModel](https://stackoverflow.com/questions/tagged/identityModel)
6539

66-
We recommend you use the "adal" tag so we can see it! Here is the latest Q&A on Stack Overflow for IdentityModel: [https://stackoverflow.com/questions/tagged/identityModel](https://stackoverflow.com/questions/tagged/identityModel)
40+
Have a design proposal? Please submit [a design proposal](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/new?assignees=&labels=design-proposal&projects=&template=design_proposal.md) before starting work on a PR to ensure it means the goals/objectives of this library and it's priorities.
6741

6842
## Security Reporting
6943

build/releaseBuild.yml

Lines changed: 11 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -111,43 +111,39 @@ jobs:
111111
**\bin\$(BuildConfiguration)\**\System.IdentityModel.Tokens.Jwt.pdb
112112
TargetFolder: '$(Build.ArtifactStagingDirectory)\ProductBinaries'
113113

114-
- task: securedevelopmentteam.vss-secure-development-tools.build-task-policheck.PoliCheck@1
114+
- task: securedevelopmentteam.vss-secure-development-tools.build-task-policheck.PoliCheck@2
115115
displayName: 'Run PoliCheck'
116116
inputs:
117117
targetType: F
118+
result: PoliCheck.xml
118119
optionsFC: 0
119120
optionsXS: 0
120121
optionsHMENABLE: 0
121122

122-
- task: securedevelopmentteam.vss-secure-development-tools.build-task-credscan.CredScan@2
123+
- task: securedevelopmentteam.vss-secure-development-tools.build-task-credscan.CredScan@3
123124
displayName: 'Run CredScan'
124125
inputs:
126+
outputFormat: pre
125127
suppressionsFile: 'build/credscan-exclusion.json'
126128
debugMode: false
127129

128130
- task: securedevelopmentteam.vss-secure-development-tools.build-task-roslynanalyzers.RoslynAnalyzers@2
129131
displayName: 'Run Roslyn Analyzers'
130132
condition: eq(variables['TargetNet8'], 'False')
131133

132-
- task: securedevelopmentteam.vss-secure-development-tools.build-task-binskim.BinSkim@3
134+
- task: securedevelopmentteam.vss-secure-development-tools.build-task-binskim.BinSkim@4
133135
displayName: 'Run BinSkim'
134136
inputs:
135-
InputType: Basic
136-
AnalyzeTarget: '$(Build.ArtifactStagingDirectory)\*.dll'
137137
AnalyzeSymPath: '$(Build.ArtifactStagingDirectory)\ProductBinaries'
138138
AnalyzeVerbose: true
139139
AnalyzeHashes: true
140140

141-
- task: securedevelopmentteam.vss-secure-development-tools.build-task-publishsecurityanalysislogs.PublishSecurityAnalysisLogs@2
141+
- task: securedevelopmentteam.vss-secure-development-tools.build-task-publishsecurityanalysislogs.PublishSecurityAnalysisLogs@3
142142
displayName: 'Publish Security Analysis Logs'
143143
continueOnError: true
144144

145-
- task: securedevelopmentteam.vss-secure-development-tools.build-task-postanalysis.PostAnalysis@1
145+
- task: securedevelopmentteam.vss-secure-development-tools.build-task-postanalysis.PostAnalysis@2
146146
displayName: 'Post SDL Analysis'
147-
inputs:
148-
BinSkim: true
149-
CredScan: true
150-
PoliCheck: true
151147
continueOnError: true
152148

153149

@@ -201,17 +197,12 @@ jobs:
201197
SymbolServerType: TeamServices
202198
TreatNotIndexedAsWarning: true
203199

204-
- task: securedevelopmentteam.vss-secure-development-tools.build-task-uploadtotsa.TSAUpload@1
200+
- task: securedevelopmentteam.vss-secure-development-tools.build-task-uploadtotsa.TSAUpload@2
205201
displayName: 'TSA upload to Codebase: WILSON Stamp: Azure'
206202
inputs:
207-
tsaVersion: TsaV2
208-
codeBaseName: WILSON
209-
uploadAPIScan: false
210-
uploadFortifySCA: false
211-
uploadFxCop: false
212-
uploadModernCop: false
213-
uploadPREfast: false
214-
uploadTSLint: false
203+
GdnPublishTsaOnboard: false
204+
GdnPublishTsaConfigFile: '$(Build.SourcesDirectory)/build/tsaConfig.json'
205+
continueOnError: true
215206

216207
- task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0
217208
displayName: 'Manifest Generator '

0 commit comments

Comments
 (0)